Static tracing confirms the resreq/select-expression parser fully
copies/interns every string (no aliasing into the short-lived
job_submit_data_t), and the pend_updates dataq's enqueue/dequeue path
cannot return the same item twice. Neither explains the UAF. Updates
the running tally of ruled-out candidates so future sessions don't
re-chase them; the controller-side HOOK_DETAIL_JOB_NEW trace remains
the sharpest open lead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XYdtrEWWZfKRRGED7raEYg
Rongsong Shen
d912d33e42